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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


BSI (the British Standards Institution) is making this submission as the 
National Standards Body for the United Kingdom. As the UK’s National 
Standards Body, BSI operates in accordance with an MOU with the UK 
Government. Our robust standards development process requires open 
and full consultation with stakeholders to build consensus based 
outcomes. This gives standards the legitimacy and degree of market 
acceptance to be used for public policy purposes. 


BSI’s standards offer an alternative to regulation that can protect 
consumers and business at the same time as helping businesses to 
innovate. While regulation may be required to correct a market failure or 
to address an urgent consumer protection issue, standards offer a market 
led opportunity that may provide better and more flexible solutions. 


BSI represents the UK view on standards in Europe (via the European 
Standards Organizations CEN and CENELEC) and internationally (via ISO 
and IEC). BSI has a globally recognized reputation for independence, 
integrity and innovation ensuring standards are useful, relevant and 
authoritative. 


BSI is responsible for maintaining the integrity of the national standards- 
making system not only for the benefit of UK industry and society but also 
to ensure that standards developed by UK experts meet international 
expectations of open consultation, stakeholder involvement and market 
relevance. It is therefore within our remit to support the ICO in 
developing childhood and age-appropriate design standards within the 
commissioner's online ‘Information Society Services’ (ISS) framework. 


British Standards and UK implementations of CEN/CENELEC or ISO/IEC 
standards are all documents defining best practice, established by 
consensus. Each standard is kept current through a process of 
maintenance and review whereby it is updated, revised or withdrawn as 
necessary. 


BSI is independent of any one stakeholder interest; our standards 
development process requires the involvement of all relevant 
stakeholders (including consumers, businesses and government) along 
with an open public consultation process. This provides the credibility for 
standards to be used as an alternative to regulation, to support regulation 
or to demonstrate compliance with regulation. BSI believes that 
consensus standards development in both technology and behaviour will 
support the ICO implement their code in Age Appropriate Design. 
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BSI is only responding to the questions that are relevant to standards and 
standardization. 


Q5. Please provide any views or evidence you have on the following: 


Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


The key challenge will be to ensure that standards developed and 
introduced are adopted by international organizations — this is relevant for 
each of the areas the ICO is exploring. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Taking a lead in developing standards presents the below opportunities; 


1. Achieving consensus 


Having a formal consensus based standards development mechanism 
will give ICO the opportunity to develop a widely accepted solution. 
BSI has the infrastructure and framework to enable this to take place. 
While the end result may not in the short term be an ISO standard, 
any work carried out based on BSI’s infrastructure, process and 
framework will have more chance of being adopted internationally. 


2. International leadership 


Utilizing globally established standard-making processes will enable the 
UK to clearly demonstrate leadership in this space. Additionally, should 
a decision be made to formally internationalise the standards, the UK 
would then be able to take a leading role in development. 


BSI’s Consumer Protection Network (CIPN) have been key drivers in 
influencing acceptance within ISO (the International Standards 
Organisation) of the development of an international standard on 
privacy by design. ISO 23485 - Consumer protection: privacy by 
design for consumer goods and services, sets out international 
guidelines for ensuring consumer privacy is embedded into the design 
of a product or service, and consumer centred privacy control and 
security of consumer products is maintained over a product lifetime. 
More information about this initiative can be found on the ISO website; 
https://www.iso.org/news/ref2291.html 


3. Reaching a broad mix of stakeholders 
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Consumers are a key stakeholder in the development of standards. 
BSI’s open, consensus-based standards process ensures that their 
views are taken into account alongside those of industry and other 
stakeholders. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


BSI supports the work of Baroness Beeban Kidron OBE, and 5Rights. The 
5Rights framework was written to offer a single, principled approach that 
could be used to set a standard by which young people are treated in the 
digital world. 


5Rights believe that: 


e The digital environment must deliberately be designed to anticipate 
the presence of children. 

e The rights that young people enjoy in the physical world should be 
enacted in their digital world. 

e Young people must have a meaningful voice in how the digital world 
treats them. 


5Rights sets out a minimum framework for design considerations for 
children and young people that may be useful for the commissioner’s 
consideration in this space. 


Q5D. examples of ISS design you consider to be good practice. 


BSI has, for the last two years, been working with the Digital Policy 
Alliance (DPA) - a group of industry technology specialists and key digital 
stakeholders chaired by The Earl of Erroll - to devise a PAS that gives 
recommendations for a framework for the provision and use of online age 
check services. 


A PAS uses a fast-track process to develop standards that can provide the 
base documents for full British, European or international (ISO/IEC) 
standards. PAS documents can be funded by industry, trade associations 
or government departments and are commonly developed with the 
intention of being global in scope and application. 


PAS 1296:2018 Online age checking - Provision and use of online age 
check services, was written to assist those businesses that are mandated 
to comply with legal requirements to conduct age checks. This includes, 
for example, checking the age of those accessing online content for 
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streaming media, adult content or using online services (e.g. dating 
services, gaming or gambling websites). 


As a result of an industry led approach, PAS 1296 gives clear guidance on 
a best practice solution to prevent online age restricted products and 
services from being accessed by inappropriate users. The PAS provides 
recommendations on the due diligence businesses can exercise to ensure 
that age check services deliver the solution that will meet a business's 
specific regulatory compliance needs. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


None A 


Email bsigroup.com 
Brief summary of what you think you could offer 


BSI has over 115 years of experience in serving the interest of a wide 
range of stakeholders. Consumers are one of the key stakeholders in the 
development of standards. BSI’s open, consensus-based standards- 
making processes ensures that consumer views are taken into account 
alongside those of industry, regulators and government stakeholders; this 
gives standards the legitimacy and degree of market acceptance to be 
used for public policy purposes. 


For more information on BSI and our role as the UK’s National Standards 


Body please visit our website https://www.bsigroup.com/en-GB/about- 
bsi/uk-national-standards-body/ 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 

Please specify: 

BSI is incorporated by Royal Charter and operates under 
a Memorandum of Understanding with UK government. 
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